xml2rfc versions prior to 3.34.0 contain an arbitrary file read vulnerability. This flaw allows an attacker to read arbitrary files from the filesystem by injecting a malicious link element into the XML when generating PDF files. The vulnerability has a high severity with a CVSS score of 8.7. A fix is available in version 3.34.0. As a workaround, untrusted input with link elements having rel="attachment" should be tested before processing.